- Webform versions prior to 1.x-4.26.6
The Webform module allows people to create forms, collect submissions, and configure access to forms and submission data. Form submissions may include uploaded files.
The module does not sufficiently force certain uploaded file types to download when served. Under certain site configurations, a file uploaded through a webform could be rendered inline by a browser, resulting in a cross-site scripting vulnerability.
This vulnerability is mitigated by the fact that someone with permission to create or edit webforms must configure the form to allow the affected file extensions, and someone must specifically open the uploaded file.
Update your site to use the most recent version of Webform module. Download available on the Webform releases page.
- Jacob Rockowitz (jrockowitz)
- Lee Rowlands (larowlan) of the Drupal Security Team
- Herb v/d Dool (herbdool) of the Backdrop Security Team
- Swan Kalata (akalata) of the Drupal Security Team
- Bram Driesen (bramdriesen) of the Drupal Security Team
- Greg Knaddison (greggles) of the Drupal Security Team
- Jess (xjm) of the Drupal Security Team